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It is believed that superselection rules in quantum mechanics can restrict the possible operation 
on a qbit. If this was true, the model used by Mayers for the impossibility of bit commitment and 
by Kitaev for the impossibility of coin flipping would be inadequate. We explain why this is not the 
case. We show that a charge superselection rule implies no restriction on the operations that can 
be executed on any individual qbit. 
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It is well known that superselection rules restrict the 
allowed operations in quantum mechanics. Therefore, it 
is natural to suggest || that the models used by May- 
ers to prove the impossibility of bit commitment |^ and 
by Kitaev for the impossibility of coin flipping Q| are in- 
adequate. Here, we show that to the contrary the models 
originally used by Kitaev and Mayers for their respective 
impossibility proofs are valid even in the context of su- 
perselection rules. 

Superselection rules are associated with conserved 
quantities such as the number of fermions. Let Hp be 
the span of jO)''^ and a fermion state and a 1 

fermion state, respectively. Let Hb be the polarisation 
state space of a photon. It may appear impossible to 
execute the swap gate S on Hp ® Hb which executes 
\^)^\y)'^ ^ \y)^\^)^ because the fermion number is not 
preserved when x ^ y. The basic idea to unvalidate this 
argument can be understood with an analogy with a com- 
mon phenomena which also appears to violate a conserva- 
tion law. Consider a photon that is reflected by a mirror. 
The dynamic of the photon, if considered separately, is 
essentially a unitary transformation which violates the 
preservation of momemtum. Of course, momentum is 
preserved because the mirror absorbs the difference in 
momemtum. Yet the mirror does not get entangled with 
the photon. The mirror can be considered as a catal- 
yser for a unitary transformation that would otherwise 
be impossible because it violates a conservation law. In 
a similar way, we will show that by using extra degrees 
of freedom as a catalyser, we can execute the swap oper- 
ation on Hp 'Si Hb, an operation that would otherwise be 
impossible. This swap operation share a similarity with 
the reflection of a photon on a mirror. However, this 
swap operation is more powerful because, as we will see, 
it implies that all operations on Hp (g) Hp, where Hp 
is any extra system, are allowed despite superselection 
rules. 

There is a subtle point here. The state of these ex- 
tra degrees of freedom must itself be a superposition of 
states with different fermion numbers. The existence of 
such initial states in nature would not violate any conver- 
sation law by itself. For example, even tough momemtum 
is a conserved quantity, a superposition of states with dif- 
ferent momemtum is a common phenomena. Neverthe- 
less, one might ask if such states really exist in the case 
of all conservation laws. It turns out that, if these initial 
states are not allowed, the original proof that bit commit- 



ment is impossible can easily be generalized. Therefore, 
in both cases, the conclusion is essentially the same. In 
this paper, we focus on the case where initial states of 
the form (1/V2)(|0)^ -|- are allowed, but the easier 
case where such a superposition is not allowed will be 
considered also. 

There is a similarity between the constraint imposed 
by the fermion number conservation superselection rule 
and the one imposed by the use of classical information 
in quantum protocols. In both cases, it was believed for 
some times that the constraint could perhaps be used 
to build a bit commitment protocol. In both cases, it 
turned out to be useless. Before the general impossibil- 
ity result, we knew that bit commitment was impossible 
if we accept the model where classical information can be 
manipulated as if it was quantum information ^ . Of 
course, researchers seriously looked for a bit commitment 
protocol that makes use of the additional constraint asso- 
ciated with classical information. The proof that this ad- 
ditional constraint cannot help is not so complicated but 
yet it took six months and many unsuccessful attempts 
before the author realised that classical information was 
actually useless [||. In the case of the fermion number 
conservation superselection rule, a few researchers also 
attempted to make use of the corresponding additional 
constraint |^ , but it took only a few weeks in this case to 
realize that the additional constraint is useless, and this 
is the subject of the current paper. 

To our knowledge, this is the first analysis of superse- 
lection rules in quantum cryptography. It is interesting 
to see that our analysis is inspired by a very simple phe- 
nomena, the reflexion of a photon in a mirror. We will 
not refer to this simple phenomena anymore, but any- 
one who knows why the mirror is not entangled with the 
photon should appreciate some connection. In the flrst 
section, we describe the model which includes superse- 
lection rules. In the second section, we show that, if 
arbitrarily small errors are ignored, this model implies 
no restriction on the possible operations on a given qbit. 



The Model 

We assume that the Hilbert space pro- 
tocol is the span of a set of orthogonal states 
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where M is the set of possible modes and, for every 
X & M, q.^ € {0,l,2,...,g™»^} where q^"'' = 1 for 
fermion modes and Q'™"^ depends on the protocol for bo- 
son modes. The state space iJ^"'') is simply the ordinary 
tensor product of the state spaces associated with the 
modes x € M. A superselection rule does not change the 
state space ('^") , but restricts the possible operations on 
this space. 

Superselection rules. A superselection rule R requires 
that, for a subset Mr C M., the quantity Qr = 
^x£Mr ^® preserved by every allowed transformation. 
More precisely, the allowed unitary transformations are 
block diagonal and each block is associated with a given 
value for Qr. We assume that every participant has 
access to a countably infinite number of extra modes 
X ^ Mr which are normally not used in the protocol 
(i.e., normally, = for these modes). For example, 
these extra modes can lie in some unused locations on 
the participant's side. 

Local transformations. Wc assume that M is parti- 
tioned between Alice and Bob in two subsets of modes 
M^ and M^ . We denote the span of the orthogonal 
states 

Similarly, we denote the span of the orthogonal states 

We have = if^ (g) H^. Locally, Alice can only ex- 
ecute unitary transformations of the form U"^ I which 
moreover respect the superselection rules. Locally, Bob 
can only execute unitary transformations of the form 
I (S) which moreover respect the superselection rules. 

Measurements. Alice has access to a countably infinite 
set of "free" modes Mp C M^-Mr. Similarly, Bob has 
access to a countably infinite set of "free" modes Mp Q 
M^ - Mr. We denote Mf = M^V) Ml- Without 
loss of generality, we assume that only the Hilbert spaces 
Hp = ®.^j^aHx and Hp = ^.^j^bH^ can be measured 
by Alice and Bob, respectively. However, there is no 
restriction on these measurements. 

Communication. Alice communicates information to 
Bob by transferring control over a mode a; G A^"^ to Bob. 
Before the communication, we have x G M^. After the 
communication, we have x £ M^ . Note that the sets 
M^ and M^ can change during the execution of the 
protocol, but the sets Mr and Mf are fixed. 

Why there is no restriction on the possible 
operations 

It may appear that a superselection rule R restricts 
the possible operations on every state space H^ associ- 
ated with a mode x G Mr. However, in fact, the re- 
striction only applies to the tensor product ^xeMrHx^ 
not to each state space H^ individually. We will show 



that, if a participant has access to as many extra unused 
modes in M r, as needed, the superselection rule R im- 
poses essentially no restriction on the operations that can 
be executed by this participant on a given state space H^ 
with x G Mr. We will only do the case where H^ is a 
qbit, but the generalisation to higher dimensions is not 
difficult. 

Consider the most general qbit state alO)*^^^ + /3|1)(^' 
for a mode x. We will show how the participant can 
swap this state with the state of a free mode z initially 
in the state |0)^^^. The swapping will only be approxi- 
mative, but it will be arbitrarily close to perfect. The 
participant uses n — 1 extra modes y = yi, . . . , y„_i 
and prepares the state {l/\/n) Y^ijZo b)'^^ where = 
1 1, . . . , 1, 0, . . . , 0) contains exactly j modes yi,...yj 
with Qy. = 1. The overall state is 

n-l 
3=0 

which can be rewritten as 

+ ^ a|0, J, 0)(-'^>) + J - 1, 0)(-'^»). 

Now, each term a\0,j, 0)("='^^^) j - 1, 0)(^'j^'^) in the 

sum have Qr = j. Any operation that preserves Qr 
is allowed. In particular, the operation S on H^ ® Hff 
that executes the swapping |0, j)^^'^ <-^- — for 
j = 1, . . . , n — 1, is allowed. For 1 < Qr < n — 1, the 
participant can execute the following. First, he executes 
a CNOT with the mode x as the source and the free mode 
z as the target. For Qr = j, we obtain the component 

a|0,i,0)(-'^»+/3|l,i-l,l)(-'^»). 

Next, conditioned on the free mode z, he executes the 
swapping S. For Qr = j, we obtain the component 

a|0,i,0)(-'^»+/3|0,j,l)(->^») 

= |0,i)(^'«^)«)(a|0)(^)+/J|l)(^)). 

If we sum all the components, the resulting state is 

{1/V^ia\0, 0, 0)(^'^'^) + /3|1, n - 1, 0)^^'^'^) 

n-l 

+ |0)(^) (g) {J2 bV^^^) » (a|0)(^) + 

Note that we have Pr((5i? = 0) = a^/n, Pr(Q/< = n) = 
and Pr(Q/f = j) = 1/n, for j = 1, ... ,n — 1, as 
expected. No conservation law is violated. Fortunately, 
this state is arbitrarily close to the state 
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which corresponds to a swapping of the two modes x and 
z. This state corresponds to the distribution of probabil- 
ity Pr{Qji = j) = l/{n - 1), j = 1, . . . , n - 1, which is 
arbitrarily close to the actual distribution of probability 
associated with the true final state. So, the participant 
has essentially executed a swap operation Sx^z between 
the two modes x and z, despite the fact that z is a free 
mode and x is apparently restricted by a superselection 
rule. 

Let He be the state space of some extra system. It 
is not difficult to see that, given such a swap operation, 
one can execute the most general transformation U on 
Hx (8> He- First, one execute the swap operation Sx^z 
on Hx ® Hz. Second, one executes U on Hz ® He in 
the same way it would have been executed on Hx ® He- 
Finally, one execute the inverse swap operation S].^^ on 
Hx®H,. 

The easier case 

Now, we consider the easier case in which an initial 
superposition of states with different values for the con- 
served quantity is not allowed. Note that, on Alice's 
side, a mixture of different values for can be purified 
with a state that has a fixed value for Q^, the maxi- 
mum of the possible values for in the mixture. The 
samething is true on Bob's side. Without loss of gener- 
ality, we can restrict the analysis to protocols in which 
the initial state on both sides is such a purification in- 
stead of a mixture. The attack will use the purification, 
but this is fine because a cheater against a non purified 
protocol can himself create such a purification in place 
of the mixture. This is essentially the same purification 
technique as in the original proof which ignored super- 
selection rules. The difference is that here, in addition, 
we make sure that all states in the initial superposition 
have the same value for the conserved quantity. Let 
and be the fixed value for the conserved quantity 
on Alice's side and Bob's side, respectively. Because the 
protocol is known by both parties, we have that Q"^ and 
and thus Qji = + is known by both parties. 
The fact that bit commitment is impossible in the model 
where Q r is fixed and known by both parties was proven 
independently by Kitaev |^ and the author. The two 
proofs are completely different. Here we present the au- 
thor's proof. We assume that the protocol is perfectly 
concealing and show that Alice can swap bit to bit 1. 
The generalization to the inexact case is not difficult. 

After the commit phase, the overall state of the pro- 
tocol associated with an honest commitment of bit w £ 
{0,1} can be written as ^(w) = Z]fe=o \/Pk{w)'4'k{w) 
where 

V'fcH = |ArV2^^f,(u;)^0f_,H. 
AgA 

and (pxi^iw) and (f>f i^{w) are states with — k and 
Qr — QR~k, respectively. Both Alice and Bob can mea- 



sure k. Because the protocol is concealing, we have that 
Pfc(O) = ^^(l) for every k because otherwise k provides 
information about w. Let p^{w) = TrA{\ipk{w)) {ipk{w)\) 
be the residual density matrix on Bob's side associated 
with a given k and w. Since Bob can measure k and then 
try to distinguish (0) and (1) to obtain information 
about w, we have that p^{0) = (1), for every fc. The 
impossibility of bit commitment applies to each k indi- 
vidually. Therefore, conditioned on k, Alice can execute 
a unitary transformation on her side which maps every 
'0fc(O) exactly into V'fe(l)- Because the different ipk{w) 
are in a superposition, the relative phase between these 
states is important. This is not a problem because Al- 
ice has control over this relative phase and she knows 
exactly the states ipk{w), including their relative phase. 
This concludes the proof. 



Discussion 

We have shown that a charge conservation superselec- 
tion rule imposes no constraint on the allowed operations 
on every single qbit. Therefore, even though neither Ki- 
taev or Mayers were aware of this fact at the time 
the models that they used in their respective impossibil- 
ity proofs are actually valid even in the context of such 
a superselection rule. In this way, we have addressed the 
specific concern mentioned by Popescu It should be 
possible to generalize this result to superselection rules 
that are based on more general conservation laws. An 
impossibility proof is no more general than the model 
used. This is not at all a new understanding for the au- 
thor. In computational complexity, many models were 
considered and only then Church and Turing proposed 
their general thesis that all reasonable models are equiv- 
alent for the purpose of computation. The lesson that 
we learned here is that we should be careful in quantum 
cryptography before we propose this kind of thesis for 
quantum protocols. 

On the experimental side, in view of our result, one 
may ask whether or not it is experimentally difficult to 
swap a fermion mode and the polarization of a photon. 
This question is irrelevant if we are interested in un- 
conditional security, but nevertheless it is an interest- 
ing question in itself. We suspect that it is difficult and 
this may have lead some people to the wrong conclu- 
sion that it is fundamentally prohibited b^ a conserva- 
tion law. The required state (l/\/^)X]j=o li)^^^ '^^^ 
principle be prepared with a non zero probability. One 
simply creates the state (1/72) ( |0) (^^^ 4- 1 1) ^^^^ ) and 
then do a projection on the desired state. The probabil- 
ity of success is small but more efficient algorithms can 
most likely be designed. In any case, in the context of 
unconditional security, efficiency is not an issue. How- 
ever, it is not clear whether or not the individual states 
(l/\/2)(|0)(») + |1)(2'^)) are available in nature. More- 
over, a fully functional quantum computer might not help 
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because it might not be able to manipulate systems that 
are restricted by the superselection rule. 
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